Netstat, the TCP/IP networking utility, has a simple set of options and identifies a computer’s listening ports, along with incoming and outgoing network connections. This data can be very helpful if you’re trying to resolve a malware issue or diagnose a security problem.

Download this free guide

Hear that screaming? A network security fail strikes again

From allegations of nation state-level interference in crucial elections, to massive botnet attacks that brought down critical online services for millions, network security dominated mainstream news cycles for weeks on end. In this guide we will explore some of the key themes driving enterprise network security initiatives, from how to protect and monitor day-to-day activity on the network, to tips on how to defend it from malicious external attackers.

By submitting my Email address I confirm that I have read and accepted the Terms of Use and Declaration of Consent.

By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

I have to admit, I much prefer graphical user interfaces when it comes to working on a computer. I’ve never been a big fan of command line tools, but occasionally some, such as Netstat, do come into their own.

Another reason I find Netstat such a useful tool is that it can be found on almost any computer by default, from Unix and Linux machines through to Windows and Macs. The fact you don’t have to install and run a separate diagnostic tool can be a life saver when dealing with a client’s PC or a quarantined machine.

Every open port on your computer is an entry point that can be exploited to gain covert access. So if you need to know what connections a machine has to the internet and what services may be open and running, Netstat can quickly tell you.

The -a parameter lists all the computer’s connections and listening ports, while the -n parameter displays addresses and port numbers in numerical format. A typical (truncated) result from Netstat -an looks like this:

Active Connections

Proto Local Address

Foreign Address

State

TCP 0.0.0.0:21

0.0.0.0:0

LISTENING

TCP 0.0.0.0:25

0.0.0.0:0

LISTENING

TCP 0.0.0.0:80

0.0.0.0:0

LISTENING

TCP 0.0.0.0:135

0.0.0.0:0

LISTENING

TCP 0.0.0.0:443

0.0.0.0:0

LISTENING

TCP 0.0.0.0:445

0.0.0.0:0

LISTENING

TCP 0.0.0.0:1035

0.0.0.0:0

LISTENING

TCP 0.0.0.0:3351

0.0.0.0:0

LISTENING

TCP 127.0.0.1:1040

0.0.0.0:0

LISTENING

TCP 127.0.0.1:1049

0.0.0.0:0

LISTENING

TCP 127.0.0.1:1059

127.0.0.1:27015

ESTABLISHED

TCP 127.0.0.1:1085

0.0.0.0:0

LISTENING

TCP 127.0.0.1:1434

0.0.0.0:0

LISTENING

TCP 127.0.0.1:5152

0.0.0.0:0

LISTENING

TCP 127.0.0.1:5152

127.0.0.1:3414

CLOSE_WAIT

The first column (proto stands for protocol) lists all of the transmission control protocol (TCP) and user datagram protocol (UDP) connections on the machine running Netstat. The second column is the machine’s local IP address and port number, while the third is the remote or foreign address and port number. The final column is called State, which is the state that the connection, or potential connection, is in.

Built-in Windows commands that can find hack attempts

“LISTENING” shows a classic open port listening for inbound connections. “ESTABLISHED” means there’s an actual connection between your machine and the remote IP and port that is able to exchange traffic. Occasionally, you’ll see “CLOSE_WAIT” in this column, which is a state TCP goes into while ending an established connection.

As you can see, there are plenty of entries with a local address of 0.0.0.0 plus a port. This designation means the port is listening on all network interfaces and will accept any incoming connection on that port number.

The local address entries beginning 127.0.0.1 are processes listening for connections from the PC itself, not from the Internet or network. If the IP address in this column is your local network IP, then the port is only listening for connections from your local network. The port is listening for connections from the Internet if it displays your online IP address.

A quick glance through Netstat’s output can alert you to many potential problems. For example, if your security policy bans the use of internet relay chat (IRC), but there are numerous connections to port 6667 (the default IRC port) on a remote machine, then there's a chance that the PC has a Trojan connected to a remote IRC server waiting to receive commands. Although Netstat only takes a snapshot, you can use the interval option to refresh the output every so many seconds. Use the Netstat command below, for example:

netstat –an 1 | find “3333”

The command will check every second and print the results if a process starts listening on TCP port 3333.

If you want to find out which process on a machine is sending out packets to a particular machine you can run:

netstat –ano 1 | find “Dest_IP_Addr”

The -o parameter outputs the process ID (PID) responsible for the connection. You can then find the program associated with a PID by typing “tasklist” at the Netstat command prompt. You can also use netstat’s -b flag, which outputs the EXE and its associated DLLs that are using the TCP and UDP ports. Finally, if you want to know when another system, such as a bot controller, connects to a machine listening on a particular TCP port, such as port 4444, you can run:

netstat –an 1 | find “4444” | find “ESTABLISHED”

In this example, Netstat will not display an output until it finds an established connection on port 4444, and it will include the source IP address connected to the port, a helpful bit of information in an investigation.

You can, of course, achieve more accurate and detailed results using a port scanner such as Nmap.

However, Netstat is already built in and the commands are quick and easy to use. You may also be interested in Microsoft’s Sysinternals Process Monitor tool, an advanced monitoring utility for Windows that shows real-time file system, Registry and process/thread activity.

*Note: The –b and –o options are not available on Windows 2000 and be aware that running them with the interval option would be a drain on a system’s resources.

About the author:Michael Cobb, CISSP-ISSAP is the founder and managing director of Cobweb Applications Ltd., a consultancy that offers IT training and support in data security and analysis. He co-authored the book IIS Security and has written numerous technical articles for leading IT publications.

0 comments

Register

Login

Forgot your password?

Your password has been sent to:

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy